> Another potential solution I’ve been considering is that for each device
object you create that filters an existing FSD volume, you create a SECOND
device object that does NOT filter anything. Then, when you need to issue
a
ZwCreateFile, you issue it against your second device object
(“\Device\MyFilterAlternativeDevice0063A” or whatever unique name you
Another useful approach:
- on CREATE path, register the file object in the some kind of map (Rtl
generic table is great for this). - then check whether the file object is registered in this map.
This is a useful thing for a filter which redirects CREATE to some another
file on the same volume due to some reasons.
Max